Fix hidden library items not rendering in the browser

Items flagged hidden_from_guests (blacklisted tags) returned 404 for
<img> requests since tags cannot send the auth header. The API now
exposes signed raw_url/thumbnail_url fields (mirroring upload previews
and avatars), and the SPA uses them in the gallery, detail view,
duplicates and delete screens, and upload visual matches.

frontend/src/features/library/DuplicatesPage.tsx

@@ -33,6 +33,8 @@ function MemberCard({
   selected: boolean;
   onToggle: () => void;
 }) {
+  const preview =
+    entry.thumbnail_url ?? `/api/files/${entry.j_id}/thumbnail/`;
   return (
     <div
       className={cn(
@@ -43,7 +45,7 @@ function MemberCard({
       <button type="button" onClick={onToggle} className="block w-full text-left">
         <div className="relative aspect-square overflow-hidden bg-ctp-mantle">
           <img
-            src={`/api/files/${entry.j_id}/thumbnail/`}
+            src={preview}
             alt={entry.j_id}
             loading="lazy"
             className="h-full w-full object-cover"
@@ -219,7 +221,10 @@ export default function DuplicatesPage() {
                 <div className="w-32 shrink-0">
                   <div className="aspect-square overflow-hidden rounded-md bg-ctp-mantle">
                     <img
-                      src={`/api/files/${group.j_id}/thumbnail/`}
+                      src={
+                        group.thumbnail_url ??
+                        `/api/files/${group.j_id}/thumbnail/`
+                      }
                       alt={group.j_id}
                       loading="lazy"
                       className="h-full w-full object-cover"